Security

Security is the product.

A data room exists for one reason: to let you share documents that must not leak. Here is exactly how we protect them.

Data protection

Encryption in transit

All traffic is served exclusively over HTTPS (TLS 1.2+). Unencrypted connections are refused.

Encryption at rest

Documents and databases are stored on encrypted volumes in our EU data centre.

Password security

Passwords are hashed with bcrypt. We never store, see or transmit plain-text passwords.

Private file storage

Uploaded files are stored under randomised names, outside the web root, and are only ever served through authenticated, permission-checked requests. There are no public links — by design.

Access control

Role separation

Administrators manage; clients can only view and download what they have explicitly been granted.

Room-level permissions

Access is granted per data room, per user — and can be revoked instantly at any time.

Immediate lockout

Disabling an account locks the user out instantly, even if they have an active session.

Brute-force protection

Sign-in attempts are rate-limited to block password-guessing attacks.

Accountability

Full audit trail

Every sign-in, room view, upload and download is recorded with user and timestamp — a complete record for closing.

Session security

Signed, HttpOnly, SameSite cookies with automatic expiry. Every form is protected against cross-site request forgery.

Hardened by default

Strict Content-Security-Policy, clickjacking protection and MIME-sniffing protection on every response.

Infrastructure

EU hosting

All data is stored and processed on servers located in [EU COUNTRY], operated by [HOSTING PROVIDER]. Nothing leaves the EU/EEA.

Isolation

The platform is fully self-contained: no third-party processors touch your documents.

Backups

Encrypted backups are taken [FREQUENCY] and retained for [PERIOD], so your deal never depends on a single disk.

Responsible disclosure. Found a vulnerability? Contact [security@YOURDOMAIN] — we respond within [X] business days and appreciate coordinated disclosure.